p PatchFirst

CVE-2020-8562

CVE-2020-8562 · Bypass of Kubernetes API Server proxy TOCTOU

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.

CVSS 2.2 · Baja · EPSS 1,2% · Corrección disponible

Publicación
Actualización

Pila tecnológica: system · containers

Productos y versiones afectados

  • kubernetes

    Versiones
    • ≥ 0: Afectada (semver)

    Sin corrección publicada

  • kubernetes Debian:12

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Actualiza a 1.20.5+really1.20.2-1

  • kubernetes Debian:13

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Actualiza a 1.20.5+really1.20.2-1

  • kubernetes Debian:14

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Actualiza a 1.20.5+really1.20.2-1

Fuentes originales

Comprueba tu servidor →